Skip to content
OpenAdvisories

Vendor

Tigera

10 known vulnerabilities.

Products

Calico 8 Calico Enterprise 8 Calico Cloud 6 Typha 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.9
    CVE-2026-6540

    L7 policy bypass via unnormalized HTTP path matching

    Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly eval…

    Tigera Calico Enterprise Calico Calico Cloud
  • High 7.2
    CVE-2026-6720

    Calicoctl leaks cluster credentials to stderr when verbose logging is enabled

    When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — …

    Tigera Calico Enterprise Calico Calico Cloud Go
  • High 7.5
    CVE-2023-41378

    Calico Typha hangs during unclean TLS handshake

    In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() …

    Tigera Calico Typha Typha Go